Is it not using the User Agent configuration of the service to which the GWS action is ultimately associated? That is, configure or customize a user agent for the service and setup the Basic Authentication policy for the url of the urlopen. If that works, you can use the Password Alias.
P.S. Let me know. I'm talking off the top of my head here.